preflight 1

Boot-time guard for DeepSeek Harness: repairs corrupt session logs, snapshots manifests + linked sources, preflights bundle resolution and composition, vm-checks client artifacts, smokes host apply() in a child process and quarantines crash-causing bundle